D-Link

Examples of D-Link products

Backdoors

D-Link systematically includes backdoors in their equipment that compromise its users security.[5] One of the prominent examples is xmlset_roodkcableoj28840ybtide, which contains the substring roodkcab, which is the word backdoor written backwards.[6]

In January 2013, version v1.13 for the DIR-100 revA was reported to include a backdoor in the firmware. By passing a specific user agent in an HTTP request to the router, normal authentication is bypassed. It was reported that this backdoor had been present for some time.[7] This backdoor however was closed soon after with a security patch issued by the company.[8]

Information about the CVE-2024-6045 backdoor was published in the National Vulnerabilities Database (NVD) in 2024.[9][10]

Vulnerabilities

In January 2010, it was reported that HNAP vulnerabilities had been found on some D-Link routers. D-Link was also criticized for their response which was deemed confusing as to which models were affected and downplayed the seriousness of the risk.[11] However the company issued fixes for these router vulnerabilities soon after.[12]

Computerworld reported in January 2015 that ZynOS, a firmware used by some D-Link routers (as well as ZTE, TP-Link, and others), are vulnerable to DNS hijacking by an unauthenticated remote attacker, specifically when remote management is enabled.[13] Affected models had already been phased out by the time the vulnerability was discovered and the company also issued a firmware patch for affected devices for those still using older hardware.[14]

Later in 2015, it was reported that D-Link leaked the private keys used to sign firmware updates for the DCS-5020L security camera and a variety of other D-Link products. The key expired in September 2015, but had been published online for seven months.[15] The initial investigation did not produce any evidence that the certificates were abused.[16]

Also in 2015, D-Link was criticized for more HNAP vulnerabilities,[17] and worse, introducing new vulnerabilities in their "fixed" firmware updates.

On 5 January 2017, the Federal Trade Commission sued D-Link for failing to take reasonable steps to secure their routers and IP cameras, as D-Link marketing was misleading customers into believing their products were secure. The complaint also says security gaps could allow hackers to watch and record people on their D-Link cameras without their knowledge, target them for theft, or record private conversations.[18] D-Link has denied these accusations and has enlisted Cause of Action Institute to file a motion against the FTC for their "baseless" charges.[19] On 2 July 2019, the case was settled with D-Link not found to be liable for any of the alleged violations.[20] D-Link agreed to continue to make security enhancements in its software security program and software development, with biennial, independent, third-party assessments, approved by the FTC.[21]

On 18 January 2021 Sven Krewitt, researcher at Risk Based Security, discovered multiple pre-authentication vulnerabilities in D-Link's DAP-2020 Wireless N Access Point product.[22] D-Link confirmed these vulnerabilities in a support announcement and provided a patch to hot-fix the product's firmware.[23]

In April 2024, D-Link acknowledged a security vulnerability that affected all hardware revisions of four models of network attached storage devices. Because the products have reached their end of service life date, the company stated in a release that the products are no longer supported and that a fix would not be offered.[24]

Server misuse

In 2006, D-Link was accused of NTP vandalism, when it was found that its routers were sending time requests to a small NTP server in Denmark, incurring thousands of dollars of costs to its operator. D-Link initially refused to accept responsibility.[25] Later, D-link products were found also to be abusing other time servers, including some operated by the US military and NASA.[26] However, no malicious intent was discovered, and eventually D-Link and the sites owner Poul-Henning Kamp were able to agree to an amicable settlement regarding access to Kamp's GPS.Dix.dk NTP Time Server site, with existing products gaining authorized access to Kamp's server.[27]

GPL violation

On 6 September 2006, the gpl-violations.org project prevailed in court litigation against D-Link Germany GmbH regarding D-Link's inappropriate and copyright infringing use of parts of the Linux kernel.[28] D-Link Germany GmbH was ordered to pay plaintiff's costs.[29] Following the judgement, D-Link agreed to a cease and desist request, ending distribution of the product, and paying legal costs.[30]